-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. Tor at 1AEO wrote:
NetFlow-style data is not neutral from a privacy perspective. While it doesn’t include payloads, it does expose timing, fan-out, retry behavior, and correlation patterns. When retained or disclosed — intentionally or otherwise — that metadata can reveal Tor traffic characteristics and failure-mode behavior that would not exist at all if such flow data were not collected.
Most uses of NetFlow are not "monitor timing on all packets" but things like "give statistics on one out of every N packets". When N is large enough, it's not practical to use it for traffic correlation attacks in that situation. Not that everyone runs it in sampled mode, of course... Not to mention, there's no reason to suggest that Hetzner got any of that information from NetFlow itself. They could have simply gotten it from a set of NetFilter (e.g. iptables) rules running on the host node that log whenever certain behavior is detected. If anything, that would be more plausible as it does not require exporting traffic when the host node itself is perfectly capable of doing analysis on its own. I agree that widespread use of NetFlow (and cflowd and all that jazz) is an issue, but I disagree that Hetzner's ability to detect certain types of traffic behavior indicates use of NetFlow or any similar technology. Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmlSSyYACgkQBh18rEKN 1gtiBQ//VinMxjLsN30n+tZDLPPbF/qerLSlK3NwzXy8pk7vXkLyuPLIzb2K9PVm V39VQ/zz2urlg5HYsBd0lScdKCWSNDsl+VdMx0cMvDfsYlhA4FHSZUJF8E6LQDq2 xmAqDZDLbQnypkiD8NEOXggqpgsCJbc6pnMJLiOBGqQ0vevdOX250uVl1HG7jTHa QiehgKfHAoZ/PlefdoOgjACGtV3iHqBW9t2ZTljetGWEF8Bon7aU0wJgX8IqK1Lt xOoknYFnoNHTXYDcuK1Ze5JqiYFWjQ9dYfsAhhCz1F9MRjk4w8FUGagOQiCieX3L nkUt4LAGkdAerUYN+2kk34WEs2pnTCWAeGztIG80GB2lq0jaZQGYU1Wu9JzKSQON o4R0sU9TMZjCqG6ZvuS1OlXbooO3xhgJAZsAw+zXZNfhY+iuMS3QoiCa/2wP7AwM 6CsPrnqDKGyHxyGdYR/QJ+3CDAYVtf9eR4bOTWBKHoMBpNNgGcIDr0EVtIvOySt4 ckD75LrfuZFkSW6oeOWKPi2YS2rzFlpnU0XDEkMAzaGEC0CTUGO82L5Fv/G4gPh/ MqEjM2NOZmtl3rcren376taUyR/N5Qi5wWi3nhPBNpXbHGcBdOaclEShgwEUOp+R uOsyChddK25OO831patX5rMFJwwgli0R1/1D2nFkpnyfgDPbEZw= =NIkP -----END PGP SIGNATURE-----